Thredd Secure Framework

Thredd's Secure Framework is the combination of several components which enables clients to access Thredd's resources securely over TLS (Transport Level Security) or mTLS (Mutual Transport Level Security). Thredd Portal sits at the centre of this, enabling Admins to manage their organisation's applications, users, and credentials to access Thredd services through a single user interface and dashboard.

Thredd supports industry standards for authentication, identity and access management, and secure network and API-level connectivity.

Key features

Identity and Access Management through Thredd Portal

  • Standards-based authentication — support for OpenID Connect (OIDC) and SAML.
  • Single-Sign On (SSO), self-service onboarding, and token lifecycle management.
  • Secure Access Control — role-based access (RBAC) and user management.

Connectivity Services

  • Secure network and API-level connectivity via VPN, TLS and mTLS.
  • Certificate lifecycle management — request, revoke and renew certificates issued by Thredd's Certificate Authority through Thredd Portal.
  • mTLS Termination for mTLS connections in an EHI mTLS setup.

Developer Tooling

  • Access Thredd REST APIs via API Hub over TLS or mTLS.
  • Test connectivity to Thredd REST APIs and API Hub using the Postman Collection in a UAT environment.

Identity and Access Management through Thredd Portal

Thredd provides a Software as a Service (SaaS) capability that acts as the Identity Provider (IDP) to authenticate user access to Thredd's interfaces through logging in to Thredd Portal. It also acts as an OAuth OpenID Provider (OP) for the registration and management of customer applications, generation and validation of access tokens, and for the enforcement of access control policies.

Thredd uses a Client Secret access token for connecting to the REST APIs.

Thredd Certificate Authority through Thredd Portal

Thredd adopts a self-service approach that enables Admin users to independently request and manage certificates for their applications from Thredd's Certificate Authority (CA) through Thredd Portal.

Thredd can provide transport certificates if required. These can be used for mTLS connections for establishing connections between resources.

Thredd Application

Certificates Required

REST API over TLS

No certificate required.

REST API over mTLS

Transport Certificate for the mTLS connection, which you obtain from Thredd Portal.

SOAP API

Transport Certificate, which you obtain from Thredd.

External Host Interface (EHI)

Server Certificate (which you obtain separately), Thredd EHI Trust Chain (that you download from Thredd Portal), and a Transport Certificate (which Thredd presents).

Thredd Portal

Certificates that are pre-installed by Thredd.